Skip to content
OpenAdvisories
High · 7.1 CVE-2020-2138 EUVD-2022-5393GHSA-vpfj-5gg5-fvfm

XXE vulnerability in Jenkins Cobertura Plugin

Published Mar 9, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Cobertura Plugin Package: org.jenkins-ci.plugins:cobertura Category: Web / CMS Ecosystem: Maven

Description

Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Cobertura Plugin unspecified – ≤ 1.15 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:cobertura < 1.16 1.16 GHSA-vpfj-5gg5-fvfm

References